Method for detecting malfunctioning in a sensor

ABSTRACT

A method for detecting a malfunction of a sensor measuring a measured quantity is provided, in which a signal-range check for the output signal of the sensor is performed, provided that the measured quantity is within a permissible range. If the measured quantity is outside the permissible range, no signal-range check is performed, but the output signal is used for detecting the measured quantity and for further calculations. The sensor may be, for example, a hot-film air-mass meter. If this is the case, the measured quantity is the drawn-in air mass, and the signal-range check is performed, provided that the engine operating state and thus the drawn-in air satisfies specifiable conditions. In addition to the signal-range check, onboard diagnoses with regard to specifiable plausibility criteria relating to the offset-drift and/or the sensitivity-drift of the sensor may also be performed.

[0001] The present invention is directed to a method for detecting amalfunction in the case of a sensor according to the species defined inthe main claim.

BACKGROUND INFORMATION

[0002] It is known that sensors which detect a measured quantity that isessential for controlling internal combustion engines, such as the airdrawn in by the internal combustion engine, must be monitored for theiroperability to detect malfunctions in a reliable manner. One way todetermine a malfunction is implementing a so-called signal-range check,for instance. In such a signal-range check, or signal-amplitudeanalysis, the output signal of the sensor is monitored to determinewhether it lies within a plausible range. A signal-range check may beimplemented in such a way, for example, that the output signal of asensor is monitored to check whether it lies between an upper and alower limit. If it exceeds the upper limit or if it undershoots thelower limit, a malfunction is determined and displayed.

[0003] Monitoring a sensor with the aid of a signal-range check for anair-mass flow sensor in the case of an internal combustion engine isknown, for instance, from the printed publication EP 0 778 406 A2. Thisknown malfunction detection method not only implements a signal-rangecheck on the basis of fixed limits, but also determines a permissiblerange for the output signal of the air-mass flow sensor, this rangebeing a function of the opening angle of the throttle valve. As theopening angle of the throttle valve increases, so does the outputvoltage of the air-mass sensor regarded as plausible. If the outputsignal lies outside the plausible range, a fault is detected and theoutput signal is no longer taken into account in the further signalanalysis.

SUMMARY OF THE INVENTION

[0004] The method according to the present invention for detecting amalfunction in the case of a sensor has the advantage over the relatedart that the detection of a malfunction is even more reliable and thatan advantageous signal analysis is also possible. This advantage resultsfrom only implementing the sensor-malfunction detection with the aid ofa signal-range check for the sensor output signal, or the sensor outputvoltage, if the respective measured value lies within a specifiablerange. However, the output signal of the sensor is taken into account incalculating the measured value even if the measured value does not liewithin the specifiable range. If the measured value lies within thespecifiable range, and if the signal-range check for the output signalof the sensor indicates that the sensor output signal does not satisfythe expected plausibility conditions of the signal-range check, a faultis detected and the sensor output signal either is not processed furtheror is only processed after an additional check to detect the measuredvalue.

[0005] Further advantages of the present invention are obtained by themeasures indicated in the dependent claims.

[0006] The method according to the present invention for detecting amalfunction of a sensor may be used in a particularly advantageousmanner in connection with an engine control system in which the outputsignal of different sensors is processed further in the engine controldevice in order to determine a particular measured variable and also tocalculate the control signal for the engine operation. The methodaccording to the present invention is implemented in an advantageousmanner, for instance, in connection with analyzing the output signal ofan air mass flow sensor, such as a hot-film air-mass meter, whichdetermines the air mass drawn in by an engine and supplies its outputsignal to the control device. Using a signal-range check, the outputsignal of the air mass flow sensor is advantageously checked only in aspecifiable partial operating range of the engine. Outside this engineoperating range, the output signal of the air mass flow sensor continuesto be analyzed. Since this signal is usually correct, a significantemission reduction may be achieved compared to systems which switch tosubstitute values in such cases.

[0007] However, the methods according to the present invention todetermine a sensor malfunction may also be used in other systems; theyare also not limited to the use in a motor vehicle.

[0008] In further advantageous refinements the methods according to thepresent invention are supplemented by an onboard-diagnosis (OBD), whichoperates in the engine control device or in the control device of theinternal combustion engine and which at least includes plausibilitychecks of the offset drift and the sensitivity drift of the respectivesensor or sensors, and advantageously runs when the motor is at astandstill.

BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Exemplary embodiments of the present invention are shown in thedrawings and are explained in detail in the following description.Specifically,

[0010]FIG. 1 shows an exemplary embodiment for implementing a method formonitoring the output signal of an air mass flow sensor, which runs inan engine control device, for instance, and allows a signal-range checkas well as various plausibility checks.

[0011] In FIG. 2, a logic circuit is shown, which represents variousconditions for fault detection; and

[0012]FIG. 3 shows in which range of the measured variable asignal-range check may be carried out for an engine control and in whichit may not, the delimitation between the ranges being represented as afunction of the speed of the internal combustion engine.

SPECIFICATION

[0013]FIG. 1 shows an exemplary embodiment of the present inventionbased on a hot-film air-mass meter by which the air flow drawn in by aninternal combustion engine is detected as a measured value. The internalcombustion engine includes all components not shown but requiredaccording to the present invention.

[0014] The hot-film air-mass meter supplies an analog output voltagewhose magnitude is a function of the air mass flowing in the intakemanifold of the internal combustion engine or the engine, and which isdesignated measured value MW. The sensor element (not shown in thedrawing) is installed in the intake manifold of the internal combustionengine, together with the evaluation circuit. To detect the air flow, acentrally located heating resistor element heats a sensor membrane onthe sensor element. The temperature distribution on the membrane isdetected by two temperature resistor elements, which are symmetricallydisposed with respect to the heating resistor element. An air massflowing over the sensor changes the temperature distribution of themembrane, resulting in a resistance differential between the upstreamand the downstream temperature resistor. The resistance differential isa function of direction and volume, so that such an air-mass flow sensoris able to simultaneously register the volume and the direction of anair-mass flow. Due to the small dimensions of the micromechanical sensorelement, a short response time is obtained. Therefore, the sensor is aso-called ratiometric sensor.

[0015] The output signal of the air-mass flow sensor is processedfurther by a microprocessor MP. As a rule, this microprocessor is partof the control device of the internal combustion engine, but in onevariant of the present invention it may also be an integral part of thesensor. As described in the following, various plausibility checks orfault detections are implemented in the microprocessor. For thispurpose, the control device of the internal combustion engine and/or themicroprocessor access(es) the required information. The control deviceis supplied with all the variables or information required for theoperation of the internal combustion engine, which may be obtained withthe aid of sensors, for example. As mentioned in the following sectionsof the description, this includes the variables required to implementthe method according to the present invention.

[0016] In accordance with the present invention, and according to theblock circuit shown in FIG. 1, the air-mass flow signal is checked forits validity in the control device. The air-mass flow sensor is able todetect pulsating air-mass flows and has no fixed lower or upper voltagelimits. Therefore, the air-mass flow sensor may generate output signalsthat reach up to its supply voltage. To also ensure that the pulsationsdo not cause any faults in the detection of the air-mass flow, thevalidity of the averaged air-mass flow needs to be checked also. Theoperating ranges of the internal combustion engine in which an analysisof the output signals of the air-mass flow sensor is problematic shouldbe excluded from consideration when implementing the signal-range check.

[0017] In FIG. 1, different fault detections, or fault paths, as well asplausibility checks are plotted, which are implemented in microprocessorMP to check the operability of the individual components. In thiscontext, reference numeral 10 denotes the fault path of the air system,and 11 the reference voltage of the fault path signal-range check, wherethe reference voltage for the sensor is checked for plausible values.Reference numeral 12 denotes the signal-range check for the outputsignal of the air-mass flow sensor, to which measured value MW for theair-mass flow has been supplied as input variable. At the output of theblock for signal-range check 12, the result of the signal-range checkfor air-mass flow sensor SRC is available.

[0018] However, the signal-range check of the measured value for theair-mass flow supplied by the sensor is only implemented if no priorfault has been detected in the reference-voltage supply. In the faultpath signal-range check 11 for detecting a fault in thereference-voltage supply, faults such as cable drop-off, short-circuitto ground and short-circuit to the supply voltage may be detected. Thepossibility of the reference voltage having a short-circuit to batteryvoltage is also covered. For this purpose, a standard signal-range checkfor the reference voltage is implemented. This is accomplished eithervia the driver block itself or by separately detecting the outputvoltage of the driver-block. A detected fault is transmitted to block 12via the connection between 11 and 12, and the actual signal-range checkfor the sensor output signal is omitted.

[0019] In addition, a block 13 is included in FIG. 1, in which theoutput signal of the air-mass flow sensor, i.e., measured value MW forthe air-mass flow, is divided by the rotational speed of the engine. Thethereby obtained result represents actual air mass LM. To carry out thedivision by the rotational speed, speed n, which normally is alwaysknown in the control device, is supplied to block 13. In block 14, airmass LM is normalized, this normalization being carried out while thecharging-air pressure is detected. Charging-air pressure LD, on the onehand, and air temperature LT, on the other hand, are supplied to block14 for this purpose, these variables being detected with the aid ofappropriate sensors.

[0020] The plausibility check for normalized air-mass signal LMN runs inblock 15. For this purpose, normalized air mass LMN as well as speed nare supplied to block 15. In addition, block 15 is provided with theresults of the fault path of air system 10, the fault path ofsignal-range check reference voltage 11, and the result of thesignal-range check in block 12. By analyzing these variables, an onboarddiagnosis for the air-mass flow sensor is realized by way ofplausibility checks. The result is available as signal OBDLMM.

[0021] Depending on the result of the individual checks, the controldevice uses a value for the valid air mass selected via a switchover 16in its further calculations. By this switchover, which encompasses threeindividual switchover-means a, b and c, either air mass LM calculatedfrom the sensor-output signal or a specified value for air mass VLLM maybe provided for the further analysis. Whether the specified value forthe air mass or calculated value VL is transmitted as instantaneous airmass depends on the results of the individual faults or plausibilitychecks, or on the result of the signal-range checks, on the basis ofwhich the switchovers of switchover-means a, b or c are implemented. Afault in fault path 11 always switches directly to specified value VLLMvia switching-means a. A fault in signal-range check 12 switches to thespecified value via b, and a detected non-plausibility in block 15causes a switchover to specified value VLLM, via switching-means c.Specified value VLMM may also be a value that the control deviceestimates from various measured variables, for instance.

[0022] Since signal-range check 12 is only implemented in particularspecifiable operating states of the engine, the switchover to specifiedvalue VLLM via switching-means b is not possible if no signal-rangecheck is implemented, which means that measured air mass LM is alwaystransmitted for further processing if no signal-range check isimplemented.

[0023] Certain time conditions may also be taken into account whenimplementing the individual signal-range checks. Specifically, thesignal-range checks are then implemented according to the followingmethods:

[0024] 1. Signal-range Check Low

[0025] A fault has occurred if the speed is within the permissible rangefor the signal-range check, that is, when it holds that the speed isbetween a minimum value nSRCmin and a maximum value nSRCmas and, at thesame time, air mass LM is below a minimum value for air mass LMSRCmin atwhich a signal-range check may still be implemented. If such a fault ispresent, the sensor signal continues to be checked for its validity andthe measured value is transmitted. If the sensor remains faulty for aspecifiable period of time that exceeds a limiting value, the sensor issaved as definitely faulty and the substitute functions are activated.The sensor signal then continues to be monitored for its validity.

[0026] The sensor is regarded as restored, or intact, when the speedlies in a permissible range for the signal-range check, i.e., it holdsthat nSRCmin≦n≦nSRCmax, and it holds for a time exceeding a limitingvalue t>tHFMSRCOK, that the air mass is greater than a minimum air massLM>LMSRCmin regarded as permissible given a valid signal-range check,and provided no other signal-range check fault has occurred in theair-mass flow sensor. The substitute functions are reversed again oncethe sensor is regarded as restored.

[0027] 2. Signal-range Check High

[0028] The signal-range check high-check is active when, atinstantaneous rotational speed and for a minimum time TSRCakt, theinjection quantity MES, which is defined as the sum of the desiredquantity and the quantity calculated by the idle-speed controller, isbelow a speed-dependent limit. This measure leads to a restriction ofthe signal-range checks to operating points with limited speed andlimited charge-air pressure.

[0029] A fault is present if it holds at active signal-range check thatthe air mass is greater than the maximum value at permissiblesignal-range check LM>LMSRCmax. The sensor signal then continues to bemonitored for its validity and the measured value is transmittednotwithstanding, that is, the measured value is supplied for the furthercalculations. Alternatively, the last valid value is retained andtransmitted.

[0030] If the sensor, given an active signal-range check, remains faultyfor a specifiable time t>tHFM, it is definitely stored as faulty and thesubstitute function is activated. The sensor signal continues to beanalyzed for its validity. The sensor is regarded as restored, orintact, if it shows at active signal-range check for an additional timet>tHFMOK that the air mass is below the maximum value at permissiblesignal-range check LM<LMSRCmax and also if no other signal-range checkfault has been detected in the air-mass flow sensor. The substitutefunctions are reversed again once the sensor is detected as restored. Ifthe signal-range check is not active, no fault will be transmitted tothe control device. Existing faults cannot be remedied if thesignal-range check is not active.

[0031]FIG. 2 shows a further specific embodiment of the presentinvention. In this context, the sensor-output voltage ULMM is analyzedin the signal-range check to ascertain whether it is within apermissible range or not. For this purpose, the sensor voltage ULMM iscompared in comparator 17 to a maximum value for air mass LMMMAX, andthe sensor-output voltage is compared in comparator 18 to a minimumvalue of air mass LMMMIN. The two comparators 17 and 18 are connected tofour AND-gates 19, 20, 21 and 22 which are additionally supplied withthe condition whether a fault detection via signal-check range is, or isnot to be implemented at all.

[0032] The condition that a fault detection is to be implemented viasignal-range check is formed with the aid of the three comparators 25,26 and 27 as well as AND-gate 28. In this context, it is assumed thatthe signal-range check must be switched off outside of arotational-speed window and above a quantity threshold, since erroneousfault detections may otherwise occur. To specify the window for thesignal-range check, a first speed value N1 is compared to a speedaveraged value NMIT in the comparators. A second comparison is carriedout by comparing a rotational-speed value N2 to the averaged value NMIT,and in a third comparison it is checked whether the sum of selected fuelquantity GKM and fuel amount BKM calculated by the idle-speed controlleris below a speed-dependent value.

[0033] Only if all conditions:

N 1≦NMIT≦N 2 and GKM+BKM≦ME

[0034] are satisfied, will a fault detection SRC be permitted. Thesignal then available at the output of AND-gate 28 will be supplied toAND-gates 19 through 22, the signal stop fault detection SRC beinggenerated at the output of inverter 29.

[0035] Stated in simplified terms, the following checks are implementedin SRC:

[0036] If the sensor voltage is greater than the maximum value of theair mass, and if a signal-range check is to be implemented, it will bedetected that the signal is in order (SRC high ok). If one of these twoconditions is not satisfied, (SRC high faulty) will be detected. Thesame holds for the minimum values of the air mass, (SRC low OK) or (SRClow defective) being detected in that case.

[0037] Regardless of whether a signal-range check is implemented or not,sensor output voltage ULMM is processed further, that is, air mass LMMis calculated from sensor voltage ULMM even if a fault was detected inthe signal-range check, provided certain conditions allowing asignal-range check are not satisfied. Therefore, air mass LMM is thencalculated without limitations from sensor voltage ULMM, this holdingwithin as well as outside of the monitoring range of the signal-rangecheck. If a fault is detected in an operating range of the engineallowing a signal-range check (on a preliminary or definite basis), thevalue of sensor voltage ULMMA last stored as valid is used to calculatethe air mass. This value ULMMA is available in memory device 23, themost current sensor output voltage being recorded in each case in memorydevice 23. Value ULMMA is formed from sensor voltage ULMM in each casewhile taking into account the characteristic curve of air-mass flowsensor (LMM). The switchover to the stored substitute value, orspecified value, is implemented via switching means 24, which isswitched if a fault is detected in block 30.

[0038] By the arrangement for implementing the signal-range check inaccordance with the present invention as shown in FIG. 2, the desiredchecks are able to be carried out, it being of no consequence whetherthe arrangement according to FIG. 2 is implemented as hardware orwhether it runs as a method in the microprocessor of the control device.

[0039] In FIG. 3, the conditions allowing, or not allowing, asignal-range check high are shown. Specifically, FIG. 3 shows the limitfor the injection quantity above the rotational speed. In the upperpart, the check of the signal-range check is high-passive, with no statechange being permitted. In the lower part of FIG. 3, the checksignal-range check is high-active and a state change is permitted. Themeasured value is processed in both ranges, provided the implemented SRCdoes not indicate a fault.

[0040]FIG. 3 does not show the conditions allowing a signal-rangecheck-low. SRC-low is only allowed above a minimum speed and only if a(cut-off) throttle valve in the vehicle, if installed, is not closed.

[0041] The plausibility checks shown in block 15 of the exemplaryembodiment according to FIG. 1, which run as onboard-diagnosis (OBD) inthe control device of the internal combustion engine during normaloperation, are described in more detail in the following. Testpossibilities for an offset and a sensitivity drift need to be providedfor a plausibility check. The plausibility check is only active if nosignal-range check fault for the sensor as well as the sensor signalitself is present in the reference voltage. Similarly, a plausibilityviolation can only be remedied if no signal-range check fault is presentin the reference voltage for the sensor and for the sensor signal. Theplausibility check includes various checks, two of which are describedin more detail below.

[0042] Plausibility Check of the Offset Drift

[0043] In this plausibility check which is implemented, for example, fora hot-film air-mass meter, a distinction is made between offset-driftlow and offset-drift high. In the plausibility check offset-drift high,a fault is detected if the output voltage of the sensor at speed zero,that is, the offset voltage, is above a specifiable first thresholdrepresenting a possible maximum value. In the plausibility checkoffset-drift low, a fault is detected if the output voltage of thesensor at speed zero is below a specifiable second thresholdrepresenting a plausible minimum value. The plausibility check of theoffset-drift is implemented when the internal combustion engine is firstoperated, as soon as an “ignition on” signal is detected or during thelaunching phase or during after-running of the control device, i.e., atspeed zero. Since no air flows, the sensor merely supplies an offsetvoltage as output voltage. This output voltage of the sensor iscontrolled to a particular voltage range in a specifiable samplingraster. In a 20 ms raster, for instance, at speed n=0 it is checkedwhether the condition

UOBD,min<+Ua<UOBD,max

[0044] is satisfied. Accordingly, the plausibility of the air-massdetection is violated if the sensor-output voltage Ua at speed zeroleaves the specified voltage window, this window being delimited by aminimum value UOBD,min and a maximum value UOBD,max. However, in thiscase the sensor signal will be controlled further for plausibility, andthe measured value obtained in each case is transmitted; the sensor willbe assumed to be temporarily defective. If the sensor remains defectivefor a specifiable time t>tOBDDEF, the plausibility violation is detectedas definite and stored, and the normally present substitute functionsare activated. The sensor signal itself, however, continues to beanalyzed for its validity so that a possibly occurring fault remedy maybe detected. Such a fault remedy is detected, or the plausibility to bechecked is regarded as restored, if the following two conditions aresatisfied for an additional specifiable time t>tOBDOK:

[0045] at speed n=0: UOBD, min<+Ua<UOBD, max

[0046] at speed n=0: no plausibility violation

[0047] The substitute functions are reversed again in each case once thesensor is regarded as restored.

[0048] Plausibility Check of the Sensitivity Drift

[0049] In addition to the offset drift, the sensitivity drift shouldalso be monitored for plausibility. The sensitivity drift in theair-mass sensor is checked for plausibility exclusively when theexhaust-gas recirculation valve is closed and when the air-mass systemis determined to be intact. The information that the exhaust-gasrecirculation valve is closed is available in the control device, ifappropriate. In systems including a charge-air pressure sensor (LDF) anda temperature sensor (TF) after the charge-air cooler, the signal of theair-mass flow sensor may be compared to a substitute value calculatedusing the general gas equation. The following relationship holds:

ML·TL/pL=constant,

[0050] ML being the air mass, TL the temperature of the drawn-in airafter the charge-air cooler, measured with the aid of a temperaturesensor, and pL the measured charging-air pressure measured with the aidof a pressure sensor. In this way, the air mass measured at atemperature TL and a charging-air pressure pL may be normalized tonormal conditions TLO. The normalized value is then monitored using awindow function for an upper and a lower plausible limiting value.

[0051] The following relationships apply:

MLO=ML(TL,pL)·TL·pLO/pL·TLO  (1)

[0052] with: nOBD, min≦n≦nOBD,max

[0053] and ME,OBD,min<ME,Sum<ME,OBD,max.

[0054] The plausibility of the air-mass detection is violated if thedetected normalized air mass leaves the specified window. The sensorsignal will then continue to be controlled for plausibility and themeasured value will be transmitted in each case. If the sensor remainsfaulty for a specified time t>tHFM, D, the plausibility violation isstored as definite and the substitute functions are activated. Thesensor signal is also analyzed for its validity, and plausibility isregarded as restored when the previous condition is satisfied for a timet>tHFMOK and for nOBD,min. In that case, the detected normalized airmass lies within the mentioned air-mass range. The substitute functionsare reversed again

What is claimed is:
 1. A method for detecting a malfunction in the caseof a sensor detecting a measured variable, whose output signal isprocessed in an evaluation unit and subjected to a signal-range check bycomparing it to at least one specifiable limiting value, and amalfunction is detected if the output signal deviates from the limitingvalue in a specifiable manner, wherein the signal-range check is onlyimplemented within a specifiable range of the measured variable and theoutput signal of the sensor continues to be processed even if themeasured value is not within the specifiable range.
 2. The method fordetecting a malfunction as recited in claim 1, wherein the sensor is anair-mass flow sensor, the measured variable is the air mass drawn in byan internal combustion engine, and the signal range check and thefurther processing of the measured value are carried out in the controldevice of the internal combustion engine.
 3. The method for detecting amalfunction as recited in claim 1 or 2, wherein the specifiable range ofthe measured variable is formed as a function of the rotational speed ofthe internal combustion engine.
 4. The method for detecting amalfunction as recited in claim 1 or 2, wherein the specifiable range isformed as a function of the injection quantity and/or a combination ofrotational speed and injection quantity.
 5. The method for detecting amalfunction as recited in claim 3 or 4, wherein the signal-range checkis only implemented if the injection-quantity limit is less than aspecifiable quantity, this quantity being a function of speed anddecreasing with an increase in speed.
 6. The method for detecting amalfunction as recited in one of the preceding claims, wherein both asignal-range check-high and a signal-check-low are implemented and faultdetection occurs at signal-range check-low if the measured quantity isless than a specifiable minimum value, and a fault is detected insignal-range check-high if the measured quantity is greater than aspecifiable maximum value.
 7. The method for detecting a malfunction asrecited in one of the preceding claims, wherein, when a fault isdetected within the permissible range for signal processing, the systemreverts to a value previously recognized as correct, and this value isavailable as substitute value for further calculations.
 8. The methodfor detecting a malfunction as recited in one of the preceding claims,wherein a plausibility check is implemented in addition to thesignal-range check, but only if the signal-range check does not detectany faults, and if this additional plausibility check includes anoffset-drift check and/or a sensitivity-drift check, in which furtherconditions, in particular voltage conditions, are monitored inspecifiable operating phases of the internal combustion engine, whichcorrespond to a rotational speed of approximately zero.
 9. The methodfor detecting a malfunction as recited in claim 8, wherein theplausibility check of the offset drift is implemented in such a way thatit checks whether the output voltage Ua of the sensor is greater than alower limiting value UOBD,min and/or is less than an upper limitingvalue UOBD,max, and a fault of the offset-drift is detected anddisplayed if this condition has not been satisfied.
 10. The method fordetecting a malfunction as recited in claim 8, wherein the plausibilitycheck of the sensitivity-drift is implemented with the exhaust-gasrecirculation valve closed and the air-mass system intact; the measuredair-mass is normalized to normal conditions and the normalized air-massis compared to at least one substitute value calculated using thegeneral gas equation, and is detected as being too large a sensitivitydrift in case of a specifiable deviation, and a corresponding fault isdisplayed and substitute measures are initiated, if warranted.
 11. Themethod for detecting a malfunction as recited in claim 10, wherein acomparison to an upper and/or lower substitute value MEOBD,max,MEOBD,min is implemented when the sensitivity drift is checked forplausibility, a non-plausibility is detected in the case of aspecifiable deviation.
 12. The method for detecting a malfunction asrecited in one of the preceding claims 8 through 11, wherein theplausibility check is continued for a specifiable time after a fault hasbeen detected, and a definite fault is detected and a substitutefunction is activated only after this time has elapsed at continuingimplausibility.
 13. The method for detecting a malfunction as recited inone of the preceding claims 8 through 12, wherein the plausibility checkis continued for a specifiable time after a malfunction has beendetected, a fault remedy is adopted when plausibility is then detected.14. A device for implementing a method for detecting a malfunction asrecited in one of the preceding claims, wherein the device has at leastone control device including a microprocessor, to which the quantitiesrequired for implementing the method are supplied, and which includesmeans for triggering the required measures and activating the substitutefunctions if a malfunction has been detected.